aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

pcap-log: fall back to sguil_base_dir option if 'dir' isn't set. Minor cleanups.

Browse Source
remotes/origin/master-1.1.x
Victor Julien 14 years ago
parent 3b3f5816bf
commit 1a5931e878
1 changed files with 41 additions and 32 deletions
Show Stats Download Patch File Download Diff File

41
src/log-pcap.c
Unescape Escape View File

@ -102,9 +102,8 @@ typedef struct PcapLogData_ {
char dir[PATH_MAX]; /**< pcap log directory */ char dir[PATH_MAX]; /**< pcap log directory */
} PcapLogData; } PcapLogData;
static PcapLogData *pl; /*pcap_dumper is not thread safe*/ static PcapLogData *pl; /**< pcap_dumper is not thread safe */
int PcapLogOpenFileCtx(PcapLogData *); int PcapLogOpenFileCtx(PcapLogData *);
static SCMutex plog_lock; static SCMutex plog_lock;
typedef struct PcapFileName_ { typedef struct PcapFileName_ {
@ -192,11 +191,11 @@ int PcapLogRotateFile(ThreadVars *t, PcapLogData *pl) {
if (pl->use_ringbuffer == RING_BUFFER_MODE_ENABLED && pl->file_cnt >= pl->max_files) { if (pl->use_ringbuffer == RING_BUFFER_MODE_ENABLED && pl->file_cnt >= pl->max_files) {
pf = TAILQ_FIRST(&pcap_file_list); pf = TAILQ_FIRST(&pcap_file_list);
SCLogDebug("Removing pcap file %s\n", pf->filename); SCLogDebug("Removing pcap file %s", pf->filename);
if (remove(pf->filename) != 0) { if (remove(pf->filename) != 0) {
SCLogError(SC_ERR_PCAP_FILE_DELETE_FAILED, SCLogError(SC_ERR_PCAP_FILE_DELETE_FAILED,
"failed to remove log file %s: %s\n", "failed to remove log file %s: %s",
pf->filename, strerror( errno )); pf->filename, strerror( errno ));
TAILQ_REMOVE(&pcap_file_list, pf, next); TAILQ_REMOVE(&pcap_file_list, pf, next);
if (pf != NULL) if (pf != NULL)
@ -205,7 +204,7 @@ int PcapLogRotateFile(ThreadVars *t, PcapLogData *pl) {
return -1; return -1;
} }
else { else {
SCLogDebug("success! removed log file %s\n", pf->filename); SCLogDebug("success! removed log file %s", pf->filename);
/* Remove directory if Sguil mode and no files left in sguil dir */ /* Remove directory if Sguil mode and no files left in sguil dir */
if (pl->mode == LOGMODE_SGUIL) { if (pl->mode == LOGMODE_SGUIL) {
@ -214,16 +213,16 @@ int PcapLogRotateFile(ThreadVars *t, PcapLogData *pl) {
if (strcmp(pf->dirname, pfnext->dirname) == 0) { if (strcmp(pf->dirname, pfnext->dirname) == 0) {
SCLogDebug("Current entry dir %s and next entry %s " SCLogDebug("Current entry dir %s and next entry %s "
"are equal: not removing dir\n", "are equal: not removing dir",
pf->dirname, pfnext->dirname); pf->dirname, pfnext->dirname);
} else { } else {
SCLogDebug("current entry %s and %s are " SCLogDebug("current entry %s and %s are "
"not equal: removing dir\n", "not equal: removing dir",
pf->dirname, pfnext->dirname); pf->dirname, pfnext->dirname);
if (remove(pf->dirname) != 0) { if (remove(pf->dirname) != 0) {
SCLogError(SC_ERR_PCAP_FILE_DELETE_FAILED, SCLogError(SC_ERR_PCAP_FILE_DELETE_FAILED,
"failed to remove sguil log %s: %s\n", "failed to remove sguil log %s: %s",
pf->dirname, strerror( errno )); pf->dirname, strerror( errno ));
TAILQ_REMOVE(&pcap_file_list, pf, next); TAILQ_REMOVE(&pcap_file_list, pf, next);
if (pf != NULL) if (pf != NULL)
@ -276,6 +275,7 @@ TmEcode PcapLog (ThreadVars *t, Packet *p, void *data, PacketQueue *pq, PacketQu
} }
SCMutexLock(&plog_lock); SCMutexLock(&plog_lock);
pl->pkt_cnt++; pl->pkt_cnt++;
pl->h->ts.tv_sec = p->ts.tv_sec; pl->h->ts.tv_sec = p->ts.tv_sec;
pl->h->ts.tv_usec = p->ts.tv_usec; pl->h->ts.tv_usec = p->ts.tv_usec;
@ -284,9 +284,10 @@ TmEcode PcapLog (ThreadVars *t, Packet *p, void *data, PacketQueue *pq, PacketQu
len = sizeof(*pl->h) + GET_PKT_LEN(p); len = sizeof(*pl->h) + GET_PKT_LEN(p);
if (pl->filename == NULL) { if (pl->filename == NULL) {
SCLogDebug("Opening PCAP log file %s", filename); SCLogDebug("Opening PCAP log file %s", pl->filename);
ret = PcapLogOpenFileCtx(pl); ret = PcapLogOpenFileCtx(pl);
if (ret < 0) { if (ret < 0) {
SCMutexUnlock(&plog_lock);
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
} }
@ -318,6 +319,8 @@ TmEcode PcapLog (ThreadVars *t, Packet *p, void *data, PacketQueue *pq, PacketQu
LIBPCAP_SNAPLEN)) == NULL) LIBPCAP_SNAPLEN)) == NULL)
{ {
SCLogDebug("Error opening dead pcap handle"); SCLogDebug("Error opening dead pcap handle");
SCMutexUnlock(&plog_lock);
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
} }
@ -328,27 +331,30 @@ TmEcode PcapLog (ThreadVars *t, Packet *p, void *data, PacketQueue *pq, PacketQu
pl->filename)) == NULL) pl->filename)) == NULL)
{ {
SCLogInfo("Error opening dump file %s", pcap_geterr(pl->pcap_dead_handle)); SCLogInfo("Error opening dump file %s", pcap_geterr(pl->pcap_dead_handle));
SCMutexUnlock(&plog_lock);
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
} }
pcap_dump((u_char *)pl->pcap_dumper, pl->h, GET_PKT_DATA(p)); pcap_dump((u_char *)pl->pcap_dumper, pl->h, GET_PKT_DATA(p));
pl->size_current += len; pl->size_current += len;
SCLogDebug("%u %u",pl->size_current, pl->size_limit); SCLogDebug("pl->size_current %"PRIu64", pl->size_limit %"PRIu64, pl->size_current, pl->size_limit);
SCMutexUnlock(&plog_lock);
SCMutexUnlock(&plog_lock);
return TM_ECODE_OK; return TM_ECODE_OK;
} }
TmEcode PcapLogDataInit(ThreadVars *t, void *initdata, void **data) TmEcode PcapLogDataInit(ThreadVars *t, void *initdata, void **data)
{ {
if(initdata == NULL) if (initdata == NULL)
{ {
SCLogDebug("Error getting context for PcapLog. \"initdata\" argument NULL"); SCLogDebug("Error getting context for PcapLog. \"initdata\" argument NULL");
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
SCMutexLock(&plog_lock); SCMutexLock(&plog_lock);
/** Use the Ouptut Context (file pointer and mutex) */ /** Use the Ouptut Context (file pointer and mutex) */
pl->pkt_cnt = 0; pl->pkt_cnt = 0;
pl->pcap_dead_handle = NULL; pl->pcap_dead_handle = NULL;
@ -363,8 +369,8 @@ TmEcode PcapLogDataInit(ThreadVars *t, void *initdata, void **data)
pl->prev_day = tms->tm_mday; pl->prev_day = tms->tm_mday;
*data = (void *)pl; *data = (void *)pl;
SCMutexUnlock(&plog_lock);
SCMutexUnlock(&plog_lock);
return TM_ECODE_OK; return TM_ECODE_OK;
} }
@ -455,6 +461,9 @@ OutputCtx *PcapLogInitCtx(ConfNode *conf)
const char *s_dir = NULL; const char *s_dir = NULL;
s_dir = ConfNodeLookupChildValue(conf, "dir"); s_dir = ConfNodeLookupChildValue(conf, "dir");
if (s_dir == NULL) {
s_dir = ConfNodeLookupChildValue(conf, "sguil_base_dir");
}
if (s_dir == NULL) { if (s_dir == NULL) {
if (pl->mode == LOGMODE_SGUIL) { if (pl->mode == LOGMODE_SGUIL) {
SCLogError(SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING, SCLogError(SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING,
@ -483,7 +492,7 @@ OutputCtx *PcapLogInitCtx(ConfNode *conf)
uint32_t max_file_limit = DEFAULT_FILE_LIMIT; uint32_t max_file_limit = DEFAULT_FILE_LIMIT;
if (conf != NULL) { if (conf != NULL) {
const char *max_number_of_files_s = NULL; const char *max_number_of_files_s = NULL;
max_number_of_files_s = ConfNodeLookupChildValue(conf, "max_files"); max_number_of_files_s = ConfNodeLookupChildValue(conf, "max-files");
if (max_number_of_files_s != NULL) { if (max_number_of_files_s != NULL) {
if (ByteExtractStringUint32(&max_file_limit, 10, 0, max_number_of_files_s) == -1) { if (ByteExtractStringUint32(&max_file_limit, 10, 0, max_number_of_files_s) == -1) {
SCLogError(SC_ERR_INVALID_ARGUMENT, SCLogError(SC_ERR_INVALID_ARGUMENT,
@ -505,7 +514,7 @@ OutputCtx *PcapLogInitCtx(ConfNode *conf)
const char *ts_format = NULL; const char *ts_format = NULL;
if (conf != NULL) { /* To faciliate unit tests. */ if (conf != NULL) { /* To faciliate unit tests. */
ts_format = ConfNodeLookupChildValue(conf, "ts_format"); ts_format = ConfNodeLookupChildValue(conf, "ts-format");
} }
if (ts_format != NULL) { if (ts_format != NULL) {
if (strcasecmp(ts_format, "usec") == 0) { if (strcasecmp(ts_format, "usec") == 0) {
@ -520,7 +529,7 @@ OutputCtx *PcapLogInitCtx(ConfNode *conf)
const char *use_stream_depth = NULL; const char *use_stream_depth = NULL;
if (conf != NULL) { /* To faciliate unit tests. */ if (conf != NULL) { /* To faciliate unit tests. */
use_stream_depth = ConfNodeLookupChildValue(conf, "use_stream_depth"); use_stream_depth = ConfNodeLookupChildValue(conf, "use-stream-depth");
} }
if (use_stream_depth != NULL) { if (use_stream_depth != NULL) {
if (ConfValIsFalse(use_stream_depth)) { if (ConfValIsFalse(use_stream_depth)) {

Write Preview
Loading…
Cancel
Save